CVE-2026-48005 in HTTP Server
Summary
by MITRE • 10/01/2026
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The Apache HTTP Server, widely deployed as one of the most popular web servers globally, contains a critical security flaw in its mod_auth_digest module that undermines the integrity of Digest authentication mechanisms when specific configuration directives are enabled. This vulnerability specifically affects versions prior to 2.4.69 across all supported platforms and stems from an insufficient validation process within the server's handling of HTTP Authorization headers during digest-based access control scenarios. The core technical deficiency lies in the failure to properly enforce nonce count (nc) checks when the AuthDigestNcCheck directive is enabled, which is designed to prevent replay attacks by ensuring that each authentication request uses a unique and incrementing sequence number.
When an attacker sends forged Authorization headers containing manipulated or invalid nonce counts, the server fails to reject these requests as expected due to missing internal authentication checks. Instead of denying access based on the integrity violation, the server processes the malformed credentials in a manner that triggers a forced re-authentication cycle for subsequent legitimate users attempting to access protected resources. This behavior effectively disrupts normal service operations by forcing repeated authentication handshakes, which consumes significant server resources including CPU cycles and memory allocation associated with cryptographic hash computations and session management overhead.
The operational impact of this vulnerability is primarily categorized as a denial of service condition rather than unauthorized data exposure or privilege escalation. By exploiting the missing checks, an unauthenticated remote client can induce continuous re-authentication loops that degrade performance for all users sharing the same authentication realm. This resource exhaustion does not require valid credentials but relies solely on the ability to send HTTP requests with crafted headers targeting endpoints protected by Digest authentication. The resulting latency and increased load may render the service unavailable or significantly slow, impacting business continuity and user experience without compromising confidential data directly through this specific vector.
From a classification perspective, this flaw aligns with CWE-287 Improper Authentication where the system fails to correctly verify identity-related attributes before granting access or processing requests. Additionally, it relates to CWE-693 Protection Mechanism Failure because the built-in security control designed to prevent replay attacks via nonce counting is bypassed due to implementation errors. In terms of offensive tactics, this vulnerability can be leveraged within MITRE ATT&CK framework techniques related to Denial of Service and potentially Reconnaissance if used to probe server behavior through error responses or timing differences during forced re-authentication cycles.
To mitigate this risk, organizations running Apache HTTP Server must upgrade immediately to version 2.4.69 or later where the issue has been resolved by correcting the internal logic governing nonce count validation within mod_auth_digest. Until upgrading is feasible, administrators should consider disabling Digest authentication in favor of more robust alternatives such as Basic Authentication over TLS if replay protection requirements are not strictly mandated, thereby removing the attack surface entirely. Alternatively, deploying a Web Application Firewall with rules capable of detecting and blocking anomalous Authorization header patterns may provide temporary relief by filtering out forged requests before they reach the vulnerable server component. Regular patch management and monitoring for unusual spikes in authentication failures or resource consumption can also aid in early detection and response to potential exploitation attempts targeting this specific weakness.